Appln.No.: 10/527,333 

Response dated January 21, 2010 

Reply to Office Action of November 12, 2009 

This listing of claims will replace all prior versions, and listings, of claims in the application:] 
Listing of Claims; 

1 . (Currently Amended) A method for analyzing access to a data communication network by a user, 

comprising: 

tracing traffic of said user via a computer, and identifying a group of networks with which 
said traffic is mainly handled, by defining relative autonomous systems and tracing the sequence of 
autonomous systems crossed by said traffic; the tracing including: 

- a first stage, to provide a list of paths of autonomous systems crossed by said traffic to 
reach each destination, and 

- a second stage, to aggregately elaborate said list of paths, outputting a tree representing all 
the paths of the autonomous systems crossed by the traffic of said user to reach each destination, 

wherein said first stage comprises the operations of inputting a file containing the IP 
addresses representing the sites most frequently visited by said user and performing a traceroute 
function for each destination site, by tracing the path to reach each destination site, and 

wherein said second stage comprises providing, in relation to the list of said autonomous 
systems crossed by said traffic of said user, at least one parameter including a percentage of use of 
the autonomous systems. 

2. (Previously Presented) A method as per claim 1, comprising determining the routing of said 
traffic on branches of said tree, and associating respective indicative values of the traffic that crosses 
the branches of said tree. 

3. (Previously Presented) A method as per claim 1, comprising using hardware probes to trace the 
traffic of said user. 
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4. (Previously Presented) A method as per claim 3, comprising configuring said hardware probes to 
provide information selected from a group including: band use of an individual link, data volume, 
protocol-subdivision, IP address-subdivision, traffic matrix between the user and the network. 

5. (Previously Presented) A method as per claim 3, comprising configuring said hardware probes to 
determine at least one item selected from a group including: sites most frequently visited by the user, 
main networks to which the user addresses traffic, and the origin of who connects up to said user. 

6. (Previously Presented) A method as per claim 1, comprising setting software agents on the data 
communication network access routers to trace said user traffic. 

7. (Previously Presented) A method as per claim 6, comprising configuring said software agents to 
trace the traffic through the interface of the router of said user to determine the main traffic lines. 

8. (Previously Presented) A method as per claim 6, comprising configuring said software agents to 
analyze the operating status of the respective router in terms of CPU load and available memory. 

9. (Previously Presented) A method as per claim 6, comprising providing a target machine for the 
transfer of the statistics obtained by said routers. 

10. (Previously Presented) A method as per claim 1, comprising generating, as the result of said 
traffic tracing operation of said user, at least one parameter selected from a group including: 
destination networks of said fraffic, percentage of fraffic involved, and pertinent autonomous system. 

11. (Canceled) 



12. (Previously Presented) A method as per claim 11, comprising fracing said path as a sequence of 
autonomous systems crossed. 
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13. (Previously Presented) A method as per claim 11, wherein in said first stage said tracing 
operations are carried out repeatedly with a given frequency. 

14. (Previously Presented) A method as per claim 13, wherein said frequency is configured to be 
determined and selected. 

15. (Previously Presented) A method as per claim 1, wherein said second stage comprises 
generating a unique tree of paths of the autonomous systems crossed by the traffic of said user to 
reach all the destinations, wherein leaves of said tree are indicative of destination subnetworks of the 
traffic of said user. 

16. (Previously Presented) A method as per claim 1, wherein the provided at least one parameter 
further includes at least one of a time value for passing through said autonomous systems and a hops 
value inside the autonomous system. 

17. (Previously Presented) A method as per claim 16, wherein said provided at least one parameter 
is expressed as an average value. 

18. (Previously Presented) A method as per claim 1, wherein said first stage comprises the operation 
of invoking for each IP address generated via said trace function, a remote service to obtain at least 
one item of information from a group including: name of the autonomous system to which the 
generated IP address belongs and the number of the autonomous system to which said generated IP 

address belongs. 

19. (Previously Presented) A method as per claim 18, wherein said remote service is the whois 
service of the databases RIBE, ARIN, APNIC. 
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20. (Previously Presented) A method as per claim 1, wherein said first stage comprises generating a 
data file including information selected from a group including: 

- order number of the autonomous system following the sequence of IP addresses provided 
by said trace function, 

- text name of the autonomous system, 

- identification number of the autonomous system, 

- number of hops that a single tracing command has measured inside the autonomous system, 

and 

- time of permanence in the autonomous system measured by a single tracing command. 

21. (Previously Presented) A method as per claim 1, comprising performing a plurality of said 
tracing functions in parallel during said first stage. 

22. (Previously Presented) A method as per claim 1, wherein said second stage comprises storing 
information of correspondence between IP addresses and data relating to the autonomous systems. 

23. (Previously Presented) A method as per claim 1, wherein said second stage comprises 
generating leaves of said tree as an identification of destination subnetworks of the traffic of said 
user and relative branches as identifications of the autonomous systems crossed by the traffic. 

24. (Previously Presented) A method as per claim 1, wherein said second stage is performed in 
association with a central memory with a data structure that represents the paths generated in said 
first stage in the form of at least one aggregated list. 

25. (Previously Presented) A method as per claim 24, wherein said at least one aggregated list is 
identified as representing a variable number of autonomous system lists that share a common 
maximum prefix. 
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26. (Currently Amended) An apparatus for analyzing access to a data communication network by a 
user, comprising: 

a processor; and 

memory storing software code that, when executed by the processor, performs: 
tracing traffic of said user; 

identifying a group of networks with which the traffic is mainly involved by 
identifying relative autonomous systems and tracing the sequence of autonomous systems crossed by 
said traffic; 

providing a list of paths of autonomous systems crossed by said traffic to reach each 

destination; 

aggregately elaborating said list of paths by outputting a tree representing all the 
paths of the autonomous systems crossed by the traffic of said user to reach each destination;-aftd 

providing, in relation to the list of said autonomous systems crossed by said traffic of 
said user, at least one parameter including a percentage of use of the autonomous svstems ; and 

inputting a file containing IP addresses representing destination sites most frequently 
visited by said user and to perform a tracing operation for each destination site, by tracing the path to 
reach each destination site . 

27. (Previously Presented) An apparatus as per claim 26, wherein the apparatus is configured to 
measure the routing of said traffic on branches of said tree and associate respective indicative values 
of the traffic crossing the branches to the branches of said tree. 

28. (Previously Presented) An apparatus as per claim 26, comprising hardware probes to trace the 

traffic of said user. 

29. (Previously Presented) An apparatus as per claim 28, wherein said hardware probes are 
configured to supply information selected from a group including: use of single link band, data 
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volume, protocol-subdivision, IP address-subdivision, traffic matrix between the user and the 
network. 

30. (Previously Presented) An apparatus as per claim 28, wherein said hardware probes are 
configured to determine at least one item selected from a group including: sites most frequently 
visited by the user, main networks addressed by the user traffic, and origin of those who connect up 
to said user. 

31. (Previously Presented) An apparatus as per claim 26, comprising software agents on a data 
communication network access router to trace said traffic of the user. 

32. (Previously Presented) An apparatus as per claim 31, wherein said software agents are 
configured to trace the traffic through the interface of the router of said user by determining main 
traffic lines. 

33. (Previously Presented) An apparatus as per claim 31, wherein said software agents arc 
configured to perform an analysis on the operating status of the respective router in terms of CPU 
load and available memory. 

34. (Previously Presented) An apparatus as per claim 31, comprising a target machine for receiving 
statistics obtained by said routers. 

35. (Previously Presented) An apparatus as per claim 26, wherein the apparatus is configured to 
generate as a result of said tracing operation of the traffic of said user at least one parameter selected 
from a group including: destination networks of said traffic, percentage of fraffic involved, pertinent 
autonomous system. 



36. (Canceled) 
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37. (Previously Presented) An apparatus as per claim 36, wherein said apparatus is configured to 
trace said path as a sequence of autonomous systems that are crossed. 

38. (Previously Presented) An apparatus as per claim 36, wherein said apparatus is configured to 
repeatedly perform said tracing operations with a given frequency. 

39. (Previously Presented) An apparatus as per claim 38, wherein said apparatus is configured so 
that said frequency can be determined and selected. 

40. (Previously Presented) An apparatus as per claim 26, wherein said apparatus is configured to 
output a unique tree of autonomous systems paths crossed by the traffic of said user to reach all the 
destinations, and wherein leaves of said tree are indicative of destination subnetworks of the traffic 
of said user. 

41. (Previously Presented) An apparatus as per claim 26, wherein the provided at least one 
parameter further includes at least one of a value of time of permanence inside said autonomous 
systems and a value of hops inside said autonomous systems. 

42. (Previously Presented) An apparatus as per claim 41, wherein the provided at least one 
parameter is expressed as an average value. 

43. (Previously Presented) An apparatus as per claim 26, wherein said apparatus is configured to 
invoke for each IP address generated via said tracing a remote service to obtain at least one piece of 
information from a group including: name of the autonomous system to which the generated IP 
address belongs and number of the autonomous system to which the generated IP address belongs. 
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44. (Previously Presented) An apparatus as per claim 43, wherein said remote service is the whois 
service of the databases RIBE, ARIN, APNIC. 

45. (Previously Presented) An apparatus as per claim 26, wherein said apparatus outputs a data file 
including information selected from a group including: 

- order number of the autonomous system following the sequence of the IP addresses 
provided by said fracing function, 

- text name of the autonomous system, 

- identification number of the autonomous system, 

- number of hops that a single tracing command has measured inside the autonomous system, 

and 

- time of permanence in the autonomous system measured by a single tracing command. 

46. (Previously Presented) An apparatus as per claim 26, wherein said apparatus is configured to 
perform in parallel a plurality of said tracing fiinctions. 

47. (Previously Presented) An apparatus as per claim 26, wherein said apparatus contains a cache 
memory to store information of correspondence between IP addresses and data relating to the 
autonomous systems. 

48. (Previously Presented) An apparatus as per claim 26, wherein said apparatus is configured so 
that leaves of said tree are destination subnetworks of the traffic of said user and relative branches of 
said tree are the autonomous systems crossed by the traffic. 

49. (Previously Presented) An apparatus as per claim 26, wherein said apparatus is associated to one 
central memory with a data structure that represents the paths generated by said apparatus in the 
form of at least one aggregated list. 
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50. (Previously Presented) An apparatus as per claim 49, wherein said at least one aggregated list is 
identified as representing a variable number of autonomous system lists that share a common 
maximum prefix. 

51. (Currently Amended) A memory having stored thereon software code that, when executed, 
performs: 

tracing traffic associated with a user of a data communication network; 
identifying a group of networks with which said traffic is mainly handled; and 
defining relative autonomous systems and tracing the sequence of autonomous systems 
crossed by said traffic, 

wherein the tracing includes: 

- a first stage, to provide a list of paths of autonomous systems crossed by said traffic 
to reach each destination, and 

- a second stage, to aggregately elaborate said hst of paths, outputting a tree 
representing all the paths of the autonomous systems crossed by the traffic of said user to reach each 
destination, 

wherein said first stage comprises the operations of inputting a file containing the IP 
addresses representing the sites most frequently visited by said user and performing a traceroute 
function for each destination site, by tracing the path to reach each destination site, and 

wherein said second stage comprises providing, in relation to the list of said autonomous 
systems crossed by said traffic of said user, at least one parameter including the percentage of use of 
the autonomous systems. 
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